fix: verify staged vendor payloads before install

[codeforester]

Summary

• Verify every staged vendor payload against the bundle manifest before and after copying.
• Derive install lock metadata from staged bytes and validate staged create, update, and standalone trees before the atomic move.
• Add a regression test that mutates a framework payload during copy and requires a fail-closed install.

Issue

Fixes #526

Validation

• bats tests/vendor.bats (10 tests passed).
• ./tests/validate.sh (683 tests passed; artifact, release, concurrency, and quality contracts passed).
• shellcheck --shell=bash --severity=warning scripts/vendor tests/vendor.bats
• bash -n scripts/vendor
• git diff --check

Security Notes

The install now rejects source mutation, copied-byte mismatch, and manifest mismatch before replacing the destination. Incomplete staging trees are cleaned up and no network or bundle-data evaluation was introduced.